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University at Buffalo 

Clinical Legal Education 

School of Law 
December 12, 2018 

Freedom of Information Act Appeal re: Expedited Processing 

FOIA/PA Appeals Unit 

DHS Inspector General 

STOP 0305 

245 Murray Lane, SW 

Washington, DC 20528-0305 

RE: FOIA Appeal of Expedited Processing 

Request No. 2018-IGFO-00203 

Dear Sir or Madam: 

We write on behalf of the co-requestors Privacy International (“PI”), the American 
Civil Liberties Union, and the American Civil Liberties Union Foundation (together, the 
“ACLU”), and the Civil Liberties and Transparency Clinic of the University at Buffalo 
School of Law (“CLTC”), to appeal your agency’s September 21,2018, decision denying 
expedited processing of our September 13, 2018, Freedom of Information Act (“FOIA”) 
request. 


I. Background 

By letter dated September 10, 2018, PI, ACLU, and CLTC requested from the 
Department of Homeland Security’s Office of Inspector General (“DHS-OIG”) copies of 
records related to investigations or audits into the use of computer hacking tools by law 
enforcement agents. The FOIA request (attached hereto as Exhibit A) sought two categories 
of records and asked for expedited processing under 5 U.S.C. § 552(a)(6)(E). 

As of today, we have received one letter in response to our request to DHS-OIG. The 
letter, from Disclosure Specialist Glenn Lewis and dated September 21, 2018, 
acknowledged receipt of our request and denied expedited processing (attached as Exhibit 
B). We have received no documents from your agency responsive to our request, nor has 
DHS-OIG cited any FOIA exemptions as a basis for refusing to disclose records. 1 

II. Basis for Anneal 

Pursuant to Department of Homeland Security FOIA regulations, 6 C.F.R 
§ 5.5(e)(4), we hereby timely appeal DHS OIG’s refusal to grant expedited processing. 
DHS-OIG’s denial letter cites two regulatory criteria as the basis for denying expedited 
processing: (1) the requirement to show that the requests involve an “urgency to inform the 


1 This appeal is timely filed within 90 days of receipt of Mi - . Lewis’ letter denying our request for 
expedited processing. We received that letter on September 21,2018. 
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public” about federal government activity, and (2) the requirement to include a statement 
“explaining in detail the basis for the request for expedited processing.” The letter states 
without elaboration that expedited processing is being denied “[b]ased on these regulatory 
criteria,” but it does not offer any meaningful explanation as to why the request fails to meet 
them. As demonstrated presently, neither of these bases for denial apply to our request. 

A. Requestors have demonstrated an “urgency to inform the public.” 

PI, the ACLU and CLTC’s detailed FOIA request amply demonstrates that there is 
an urgency to inform the public about the governments use of hacking tools. FOIA and DHS 
regulations require expedited processing of requests when a “compelling need” for 
information that creates an “urgency to inform the public concerning actual or alleged 
Federal Government activity” and the request is “made by a person who is primarily 
engaged in disseminating information.” 5 U.S.C. § 552(a)(6)(E); 6 C.F.R § 5.5(e)(ii). DHS 
regulations elaborate that the requester “must establish a particular urgency . . . that extends 
beyond the public’s right to know about government activity generally.” 6 C.F.R. § 

5.5(e)(3). Importantly, DHS regulations provide that “[t]he existence of numerous articles 
published on a given subject can be helpful to establishing the requirement that there be an 
‘urgency to inform’ the public on the topic.” Id. 

PI, ACLU, and CLTC’s request satisfies the criteria specified in the statute and DHS 
regulations. The request demonstrates that these there is an “urgency to inform the public” 
concerning government hacking technologies and, in particular, any DHS-OIG 
investigations or audits of government hacking techniques. The request elaborates in great 
detail on the matter or activity in question and “why the records sought are necessary to be 
provided on an expedited basis.” Id. Indeed, the request includes more than eight pages of 
information about law enforcement agencies’ deployment of hacking and related social 
engineering techniques to access and gather information on computer systems. See Ex. A, at 
1-8, 16-17. These explanations are supported by numerous footnoted citations to sources 
and authority. Id. 

Moreover, the request demonstrates that the government’s use and misuse of hacking 
technology has created an “urgency to inform the public on the topic” by citing to 
“numerous articles on the subject” published in newspapers, 6 C.F.R. § 5.5(e)(3), as well as 
recent reports from NGOs and other sources—including an OIG report from another law 
enforcement agency. Nearly all of th ese sources are from from the past year or two. See Ex. 
A, at notes 3-21, 34-36, 43, 55-56 and accompanying text. Additionally, numerous breaking 
news stories have recently been published on the government’s use of hacking tools. See Ex 
A, at 16 & n. 5 5. At least one of these breaking news stories resulted in an Department of 
Justice OIG investigation that itself was the subject of considerable media interest. See id. at 
16 n. 56. In the short time since the request was filed, there have been yet more news stories 
about government hacking, including by components of DHS. 2 All of these sources 


2 See, e.g., Thomas Brewster, Trump’s Immigration Cops Just Gave America’s Hottest iPhone 
Hackers Their Biggest Payday Yet, Forbes, Sep. 18,2018, 

https://vvvvvv.forbes.eom/sites/thomasbrewster/2018/09/18/ice-iust-gave-americas-hottest-iphone-hackers-their- 

biggest-payday-y et/#216552b04d02 ; Lorenzo Franceschi-Bicchierai, Mcihvare Companies Are Finding New 
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demonstrate, individually and collectively, that there is an immediate, current, and ongoing 
public interest in this topic “that extends beyond the public’s right to know about 
government activity generally” 6 C.F.R. § 5.5(e)(3). 

The request elaborates specific reasons why this subject matter is of current 
exigency to the American public. Failure to obtain prompt disclosure would compromise an 
urgent interest of the general public in understanding how the government is using—and 
whether the government is misusing—a new and extraordinarily intrusive investigative 
technology. The request shows, for example, that these techniques are proliferating rapidly, 
particularly now that they are available commercially to law enforcement agencies. As the 
request explains, Privacy International has identified over 500 surveillance technology 
companies that sell products and services exclusively to government clients for law 
enforcement and intelligence-gathering purposes, * * 3 including tools to enable hacking. 

The rapid proliferation of this technology raises grave concerns about individual 
privacy and technological security. As the request explains in detail, hacking is a 
particularly intrusive technology, permitting both remote access to systems as well as novel 
forms of real-time surveillance. See Ex. A at 7. These techniques create a significant 
potential for misuse, as government actors can weild these techniques covertly and on a 
wide scale. See Ex. A at 8. A single hacking operation can sweep up individuals who are 
unrelated to a government investigation, potentially violating their rights to privacy and 
risking the exposure or sensitive information. See Ex. A at 8. 

Similarly, the use of hacking raises concerns about device security. The 
government’s use of malware might proliferate to systems beyond the target device, and 
may lead to similar attacks by other actors. See Ex. A at 7. Given the potential for misuse of 
these tools, the public has a strong interst in understanding the rules that govern them. See 
Ex. A at 8. This is especially true for understanding when and where a warrant is required 
for the government to collect information through the use of hacking tools. See Ex. A at 8. 

The public thus has an exigent need for information about the kinds of hacking that 
the government is engaged in and, especially, whether DHS-OIG and other offices of 
inspector general have investigated for instances of waste, fraud, abuse, illegality, or other 
problems with respect to such techniques. This information is critical to inform the current 
and urgent public debate about the wisdom and legality of these methods, and to inform the 
public about whether the public’s constitutional and statutory privacy interests are being 
violated. 


Ways to Spy on iPhones, Motherboard, Nov. 27, 2018, 

https://motherboard.vice.com/en us/article/mbv7kq/malware-to-spv-hack-iphones : Joseph Cox, The FBI 
Created a Fake FedEx Website to Unmask a Cybercriminal, Motherboard, Nov. 26, 2018, 
https://motherboard.vice.com/en us/article/d3b3xk/the-fbi-created-a-fake-fedex-website-to-unmask-a- 

cvbercriminal : 

3 Privacy International, Privacy International Launches the Surveillance Industry Index & New 
Accompanying Report, Oct. 23, 2017, https://www.privacyintemational.org/blog/54/privacy-international- 
launches-surveillance-industry-index-new-accompanving-report (last visited July 18, 2018). 
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B. Requesters are “primarily engaged in disseminating information to the public.” 

PI, the ACLU, and CLTC also satisfy the second prong of the applicable test for a 
“compelling need” because they are “primarily engaged in disseminating information” 
within the meaning of the statute and regulation. 5 U.S.C. § 552(a)(6)(E)(v)(II); 6 C.F.R. § 
5.5(e)(ii). The request provides more than five pages of evidence to establish this point. See 
Ex. A. at 10-16. To summarize briefly, PI engages in research and litigation specifically in 
order to shine light on overreaching state and corporate surveillance. PI achieves this goal 
primarily by disseminating information it gathers to the public by publishing reports, 
websites, blog posts, and several other types of material meant for general public 
consumption. See Ex. A, at 10-11 & nn. 29-36. Similarly, the ACLU works to defend and 
preserve the individual rights and liberties guaranteed by the Constitution and laws of the 
United States by gathering and disseminating information. Indeed, obtaining information 
about government activity, analyzing that information, and widely publishing and 
disseminating that information to the press and public are critical and substantial 
components of the ACLU’s work and are among its primary activities. See Ex. A, at 11-14 
& nn. 37-49. Finally, CLTC is a legal clinic that works in its own name and on behalf of 
clients to obtain and disseminate information on issues involving technology & privacy and 
law enforcement accountability, among others. See Ex. A., at 15 & nn. 50-53. There is thus 
no doubt that the requesters satisfy the requirement of being “primarily engaged in 
disseminating information.” 4 

For these reasons, there is an “urgency to inform the public” that justifies expedited 
processing, and DHS-OIG’s denial should be reversed. 

III. Request for Relief 

For the foregoing reasons, we submit that PI, the ACLU, and CLTC are entitled to 
expedited processing. We respectfully request that you grant expedited processing and 
immediately begin processing the requested records immediately for potential release. 

Please direct all correspondence relating to this request to: 

Jonathan Manes 

Civil Liberties & Transparency Clinic 
University at Buffalo School of Law 
507 O’Brian Hall, North Campus 
Buffalo, NY 14260-1100 
(716) 645-6222 
immanes@buffalo.edu 


4 Only one of the requestors needs to qualify in order for expedited processing to be required. See 
ACLUv. DOJ, 321 F. Supp. 2d at 30 n. 5 (citing Al-Fayeclv. CIA, 254 F.3d300, 309 (D.C. Cir. 2001) (“[A]s 
long as one of the plaintiffs qualifies as an entity ‘primarily engaged in disseminating information,’ this 
requirement is satisfied.”). 
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Thank you for your prompt attention to this matter. 


Brett Max Kaufman 
Vera Eidelman 

American Civil Liberties Union 
Foundation 

125 Broad Street, 18th Floor 
New York, NY 10004 
bkaufman@aclu.org 
veidelman@aclu.org 


Sincerely, 



Jonathan Manes, supervising attorney 
Alex Betschen, student attorney 
RJ McDonald, student attorney 
Colton Kells, student attorney 
Civil Liberties and Transparency Clinic 
University at Buffalo School of Law, SUNY 
507 O’Brian Hall, North Campus 
Buffalo, NY 14260-1100 
Tel: 716.645.6222 
jmmanes@buffalo.edu 


Jennifer Stisa Granick 

American Civil Liberties Union 

Foundation 

39 Drumm Street 

San Francisco, CA 94111 

Tel: 415.343.0758 

jgranick@aclu.org 


Scarlet Kim 

Privacy International 

62 Britton Street 

London EC1M 5UY 

United Kingdom 

Tel:+44 (0)203 422 4321 

scarlet@privacyinternational.org 


5 



